---
schema_version: '1.0'
id: security-20260711-cdb45c
url: https://osv.dev/vulnerability/GHSA-6v7p-g79w-8964
url_hash: cdb45c2b9d1c8b6bf0e0b02a3f3be3e6434de17386af8f070b7c0da948b4855d
canonical_url: https://osv.dev/vulnerability/GHSA-6v7p-g79w-8964
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-57585
- GHSA-6v7p-g79w-8964
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- msgpack
- PyPI
lang: en
published_at: '2026-06-19T21:42:55Z'
fetched_at: '2026-07-11T06:37:18Z'
updated_at: '2026-07-11T06:39:11Z'
status: published
content_hash: 76bce6d8e3782bd48d3387c04609b39abec520af539f4ff64dc34428a7b04294
license_note: full
summary: 'MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after
  a caught error'
summary_source: rss
summary_en: 'MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse
  after a caught error'
entities:
- name: Forbes JAPAN
  type: organization
- name: Python
  type: artifact
key_facts: []
related: []
related_auto:
- name: URL
  type: content
  weight: 2.0
- name: BING
  type: organization
  weight: 1.0
- name: コンテンツ
  type: UNKNOWN
  weight: 1.0
title: 'CVE-2026-57585: MessagePack for Python: Out-of-bounds read / crash on Unpacker
  reuse after a caught error'
---

# CVE-2026-57585: MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error

## TL;DR
MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error

## Key Points
- cve / CVE-2026-57585 / GHSA-6v7p-g79w-8964 / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H / msgpack / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
**Advisory:** GHSA-6v7p-g79w-8964 (CVE-2026-57585)

**Affected (your watchlist):**
- `PyPI:msgpack` 1.1.2 → fixed in 1.2.1 [docker/docker-llmwiki]

**Details:**
### Impact

If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.

If the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.

### Patches

v1.2.1

### Workarounds

Users should create a new Unpacker instead of reusing the same Unpacker after an error occurs.

Applying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct data. If an error occurs during Streaming Unpacking, the Stream and Streaming Unpacker should be discarded.

Therefore, this is not just a workaround but the correct solution. The above patch only prevents crashes from incorrect usage.

**References:**
- https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964
- https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d
- https://github.com/msgpack/msgpack-python
- https://github.com/msgpack/msgpack-python/releases/tag/v1.2.1

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-6v7p-g79w-8964_

## Source
元記事: [CVE-2026-57585: MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error](https://osv.dev/vulnerability/GHSA-6v7p-g79w-8964) — published 2026-06-19T21:42:55Z